FTC sues Hims & Hers: your tracking pixels are liability

On July 30 the FTC, joined by California and Utah, sued Hims & Hers in the Northern District of California. The core allegation is not exotic: the company ran ordinary tracking pixels from Meta, Snap, Microsoft, Pinterest, Reddit, and X on its site, and those pixels sent along what visitors were there for. Every one of those tags is available to you in about four clicks. That's why this is your problem too.

What actually happened

Per TechCrunch and The Register, the complaint says Hims & Hers shared health information two ways: by uploading customer lists to ad platforms, and passively — via tracking technologies that fired "Events" as visitors moved through the site — contrary to its own privacy policy. The suit also targets billing: customers allegedly charged and enrolled in recurring subscriptions before a provider consultation, and a cancellation flow that ran three to ten survey questions deep. Regulators want injunctions, money back for consumers, and civil penalties. The company denies wrongdoing and says it will defend the case; CNBC reported the stock fell about 10%.

Note what nobody is alleging. No breach. No hacker. No leaked database. The data left through the marketing stack, working exactly as configured.

Why tracking pixels matter for your business

You are not a telehealth company, so the health-data angle may not touch you. The mechanism does. A Meta pixel with automatic advanced matching on, a Google Tag Manager container three agencies have edited, a conversion event named after the product page someone landed on — that's a data-sharing arrangement you never read. The FTC's theory here is straightforward: what your privacy policy promises has to match what your tags actually do. And the same complaint bundles subscription billing and cancellation friction, which is the other place small commerce businesses quietly accumulate exposure.

Do this in an afternoon:

1. Open DevTools, Network tab, filter on facebook, snap, google, clarity. Click through your funnel — product page, cart, checkout, account. Read the payloads. Not the tag names. The payloads.
2. In GTM, list every tag, its trigger, and who added it. Delete anything nobody can defend.
3. Turn off automatic/advanced matching unless you can point to the consent that covers it.
4. Compare what you found against your published privacy policy, line by line. Fix whichever one is lying.
5. Cancel your own subscription as a customer would. Count the clicks.

The tags are cheap to audit and expensive to ignore. That's an unusually good trade.

Sources: TechCrunch, The Register.